7.5

CVE-2019-7642

Exploit
D-Link routers with the mydlink feature have some web interfaces without authentication requirements. An attacker can remotely obtain users' DNS query logs and login logs. Vulnerable targets include but are not limited to the latest firmware versions of DIR-817LW (A1-1.04), DIR-816L (B1-2.06), DIR-816 (B1-2.06?), DIR-850L (A1-1.09), and DIR-868L (A1-1.10).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dlink ≫ Dir-817lw Firmware Version 1.04
   Dlink ≫ Dir-817lw Version a1
Dlink ≫ Dir-816l Firmware Version 2.06
   Dlink ≫ Dir-816l Version b1
Dlink ≫ Dir-816 Firmware Version 2.06
   Dlink ≫ Dir-816 Version b1
Dlink ≫ Dir-850l Firmware Version 1.09
   Dlink ≫ Dir-850l Version a1
Dlink ≫ Dir-868l Firmware Version 1.10
   Dlink ≫ Dir-868l Version a1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.6% 0.834
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://github.com/xw77cve/CVE-2019-7642/blob/master/README.md
Third Party Advisory
Exploit